Every cookie the forge sets is HttpOnly, SameSite and Secure behind HTTPS: one test finds each place it sets one #11864

Trust: sessions in HttpOnly cookies, nothing to toggle. src/http/cookie_secure.ts decides Secure; nothing proves every Set-Cookie site uses it.

Done looks like:

• [x] test/cookie-flags.test.ts searches src/ for each place a cookie is written and drives the route that writes it (sign-in, sign-out, claim link, consent, any preference cookie), asserting HttpOnly (except a named list of cookies a page script must read, each with its reason), SameSite=Lax or Strict, Path=/, and Secure when the request came over HTTPS.
• [x] A new Set-Cookie site with no entry in the test fails it, naming the file and line.
• [x] Fix what it finds in the same pull.

Files: test/cookie-flags.test.ts, src/http/cookie_secure.ts (only to fix a finding) Risks: do not weaken a cookie to pass; a script-readable cookie needs its reason written beside it. Brief: a Sonnet builder (Mason or Scout). Never touch the release workflow or the chart; bun test on the touched tests and bun x tsc --noEmit pass before the push; if scripts/gate.ts still lists tests by hand, add the new test there in the same commit.

Reviewed pull #11882 at its head: ticked test/cookie-flags.test.ts searches src/ for each place a cookie is written and drives the route that writes it (sign-in, sign-out, claim link, consent, any preference cookie), asserting HttpOnly (except a named list of cookies a page script must read, each with its reason), SameSite=Lax or Strict, Path=/, and Secure when the request came over HTTPS.; A new Set-Cookie site with no entry in the test fails it, naming the file and line.; Fix what it finds in the same pull..